{"version":"2.1.260","anchor":"url-schema-now-rejects-credentialed-urls-and-gained-an-allow","canonical_anchor":"url-schema-now-rejects-credentialed-urls-and-gained-an-allow","heading":"URL schema now rejects credentialed URLs and gained an allowHttp option","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/url-schema-now-rejects-credentialed-urls-and-gained-an-allow","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### URL schema now rejects credentialed URLs and gained an allowHttp option\n\nMCP server URLs with embedded credentials are now rejected, and plain-http can be explicitly allowed.\n\nThe shared URL schema used for MCP server URLs and similar fields now rejects URLs containing embedded userinfo (`user:pass@host`), reporting a dedicated `CREDENTIALED_URL_MESSAGE` error. A new `allowHttp` option can be set on the schema to permit plain-http URLs beyond the existing loopback-http allowance.\n\n- Area: MCP\n- Names: `allowHttp`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}